Threat reportVulnerabilityTL-2026-4857
CISA adds GitLab CE/EE (CVE-2026-97229) and Cisco ASA/FTD (CVE-2026-76418) flaws to KEV catalog
CISA adds GitLab CE/EE (CVE-2026-97229) and Cisco ASA/FTD (TL-2026-4857) is a critical-severity software vulnerability scored CVSS 10, first published 2026-10-30. It has no confirmed attribution, affects GitLab GitLab Community Edition and Enterprise Edition (self-managed), references 3 CVEs (CVE-2026-97229, CVE-2026-76418, CVE-2026-20349), maps to 4 MITRE ATT&CK techniques (T1059, T1133, T1190), and is covered by 9 detection rules and 6 indicators of compromise.
- CVSS
- 10/10Critical
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 6Indicators of compromise
Key facts for TL-2026-4857
- Threat ID
- TL-2026-4857
- Severity
- CRITICAL
- CVSS
- 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, technology, telecoms
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 6
Malware and tooling in CISA adds GitLab CE/EE (CVE-2026-97229) and Cisco ASA/FTD
Malware and tooling: GitLab CE/EE CI/CD Regular Expression Compiler
How CISA adds GitLab CE/EE (CVE-2026-97229) and Cisco ASA/FTD works
CISA added two exploited vulnerabilities to the KEV catalog on 2026-10-29: CVE-2026-97229 (GitLab CE/EE, CVSS 10.0, unauthenticated code execution via a crafted regular expression in CI/CD configuration) and CVE-2026-76418 (Cisco Secure Firewall ASA/FTD, CVSS 8.6, unauthenticated remote DoS causing device reload). KEV due date for federal agencies is 2026-11-01.
CVE-2026-97229 is an integer overflow or wraparound (CWE-190) in GitLab's CI/CD Regular Expression Compiler, the component that parses, compiles and evaluates regular expressions in project pipeline configuration files. Insufficient regular expression validation lets an unauthenticated user execute arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration. GitLab scored it CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). It affects GitLab CE/EE 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2 (BleepingComputer lists 19.3.4 as the 19.3 fix; GitLab's own release page states 19.3.5). It was reported by researcher 'joaxcar' through HackerOne and fixed in the 2026-10-12 patch release. GitLab.com was already patched and GitLab Dedicated is not affected. Per the source feed, Alpine Linux reported unsuccessful exploitation attempts on 2026-10-20/21. As of 2026-10-13 there were public exploit claims but no confirmed working PoC. GitLab states six threat-detection rules are available for self-managed instances.
CVE-2026-76418 affects Cisco Secure Firewall ASA Software and Secure Firewall Threat Defense (FTD) Software (hunt classification: unchecked return value leading to NULL pointer dereference). Cisco disclosed it on 2026-10-28 under advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 (bug ID CSCwx26625), CVSS 8.6. According to securityonline.info, logic errors when secondary authentication is configured on a tunnel group let an unauthenticated remote attacker send crafted requests that reload the device. Exposure requires the webvpn keyword enabled on at least one interface and secondary-authentication-server-group configured on a tunnel group or DefaultWEBVPNGroup. Cisco PSIRT confirmed exploitation in October 2026; attacker identity and targeting scope were not disclosed. Cisco lists no IOCs. Cisco's published mitigation is to disable secondary authentication (no secondary-authentication-server-group) or no tunnel-group-list enable. It was discovered by Eric Fernald during a Cisco TAC case.
Source discrepancy: Cisco's earlier ASA/FTD VPN DoS flaw CVE-2026-20349 (advisory cisco-sa-asaftd-vpn-dos-dzv4mQFF, published 2026-08-11, exploited since August 2026, CVSS 8.6, CWE-244, no workarounds) has a similar impact but a different CVE, advisory and fixed releases. None of the fetched sources links the two, so they are treated as separate issues and CVE-2026-20349 is recorded only as related context. Likewise, the CISA KEV page text cites BOD 26-04 while the source feed cites BOD 22-01; both name a 2026-11-01 due date. No threat actor attribution, malware or network IOCs are stated for either vulnerability.
MITRE ATT&CK techniques used in TL-2026-4857
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1133 External Remote Services; T1190 Exploit Public-Facing Application
Impact
T1499.004 Endpoint Denial of Service: Application or System Exploitation
Affected products and versions in CISA adds GitLab CE/EE (CVE-2026-97229) and Cisco ASA/FTD
- GitLab — GitLab Community Edition and Enterprise Edition (self-managed)
Vulnerable versions: 19.2 before 19.2.8; 19.3 before 19.3.5; 19.4 before 19.4.2
Fixed in: 19.2.8; 19.3.5; 19.4.2 - Cisco — Secure Firewall ASA Software
Vulnerable versions: 9.16; 9.18; 9.20; 9.22; 9.23; 9.24
Fixed in: 9.16.4.104; 9.18.4.96; 9.20.4.50; 9.22.3.200; 9.23.1.48; 9.24.1.27; 9.24.10.1 - Cisco — Secure Firewall Threat Defense (FTD) Software
Vulnerable versions: 7.0; 7.2; 7.4; 7.6; 7.7; 10.0; 10.1
Fixed in: 7.0.11; 7.2.13; 7.4.9; 7.6.7; 7.7.14; 10.0.3; 10.1.1
Remediation for CISA adds GitLab CE/EE (CVE-2026-97229) and Cisco ASA/FTD
Patches
- GitLab patch release 19.4.2 / 19.3.5 / 19.2.8 (2026-10-12)
- Cisco advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 fixed releases
Immediate actions
- Upgrade self-managed GitLab CE/EE to 19.2.8, 19.3.5 or 19.4.2 or later
- Upgrade Cisco ASA to 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 or 9.24.10.1, and FTD to 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 or 10.1.1
- Meet the CISA KEV due date of 2026-11-01 and perform forensics triage on GitLab servers as required by the KEV entry
- Review GitLab CI/CD configurations and server logs for unusual regular expressions or unexpected process execution on the GitLab host
Workarounds
- Cisco ASA/FTD: disable secondary authentication on tunnel groups (no secondary-authentication-server-group) or run no tunnel-group-list enable, per securityonline.info summary of the Cisco advisory
- GitLab: no workaround documented; upgrade required
Longer-term hardening
- Restrict GitLab and ASA/FTD VPN management and service exposure to required networks only
- Enable the GitLab threat-detection rules published for self-managed instances
- Monitor Cisco ASA/FTD for unexpected reloads and crash events and alert on them
CVEs associated with CISA adds GitLab CE/EE (CVE-2026-97229) and Cisco ASA/FTD
Weaknesses (CWE) in CISA adds GitLab CE/EE (CVE-2026-97229) and Cisco ASA/FTD
Timeline of CISA adds GitLab CE/EE (CVE-2026-97229) and Cisco ASA/FTD
- Cisco publishes advisory for the related ASA/FTD VPN DoS CVE-2026-20349 (exploited since August 2026); distinct from CVE-2026-76418 per available sources
- GitLab discloses CVE-2026-97229 (reported by joaxcar via HackerOne) and releases fixes 19.4.2, 19.3.5 and 19.2.8; GitLab.com already patched
- Reporting notes public exploit claims for CVE-2026-97229 but no confirmed in-the-wild exploitation or reliable PoC
- Alpine Linux reports unsuccessful attempted exploitation of CVE-2026-97229 (activity on 2026-10-20/21)
- Cisco discloses CVE-2026-76418 (cisco-sa-asaftd-tunnel-dos-s6mgkb75); Cisco PSIRT confirms exploitation in October 2026
- CISA adds CVE-2026-97229 and CVE-2026-76418 to the KEV catalog with a 2026-11-01 due date
- Security Affairs reports the KEV additions
- Federal agency remediation deadline for both vulnerabilities
Sources cited for CISA adds GitLab CE/EE (CVE-2026-97229) and Cisco ASA/FTD
- U.S. CISA adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog
- CISA Known Exploited Vulnerabilities Catalog
- GitLab Patch Release: 19.4.2, 19.3.5, 19.2.8
- BleepingComputer: GitLab warns of max severity code execution vulnerability
- SOCRadar: CVE-2026-97229 critical GitLab RCE
- Cisco Secure Firewall vulnerability exploited (SSL VPN) - CVE-2026-76418, cisco-sa-asaftd-tunnel-dos-s6mgkb75
- Cisco Security Advisory: ASA/FTD Remote Access VPN DoS (CVE-2026-20349, related)
- BleepingComputer: Cisco warns of ASA and FTD VPN flaw exploited to crash devices (CVE-2026-20349, related)
Detection coverage for TL-2026-4857
As of 2026-10-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4857 across Splunk SPL, Microsoft KQL and Sigma, covering 6 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.